People who buy or sell guns on Facebook can violate the social network’s ban on gun purchases 10 times before they’re kicked off the service, The Washington Post reported Thursday. Facebook’s 10-strikes rule is detailed in “internal guidance obtained by The Washington Post,” the article said:

The policy, which has not previously been reported, is much more lenient than for users who post child pornography, which is illegal, or a terrorist image on Facebook, which prompts immediate removal from the platform.

A separate five-strikes policy extends even to gun sellers and purchasers who actively call for violence or praise a known dangerous organization, according to the documents.

The policy apparently used to be even more lenient. “Until 2020, the strike threshold for guns was more than 10,” the Post wrote, citing anonymous sources. “That threshold seemed ‘too high’ to many employees, who argued to reduce it to 10 strikes or lower.”

Facebook banned gun sales in 2016. Its gun policy says the “purchase, sale, or trade of firearms, ammunition, and explosives between private individuals isn’t allowed on Facebook.”

Facebook defends strike policy

We contacted Facebook today and will update the article if we get a response. But the company did not dispute the existence of the 10-strikes rule, according to the Post.

“Facebook spokesman Andy Stone said in a statement that the company quickly removes posts that violate its policy prohibiting gun sales and imposes increasingly severe penalties for repeat rule-breakers, including permanent account suspensions,” the Post article said.

Stone was quoted as saying, “If we identify any serious violations that have the potential for real-world harm, we don’t hesitate to contact law enforcement. The reality is that nearly 90 percent of people who get a strike for violating our firearms policy accrue less than two because their violations are inadvertent and once we inform them about our policies, they don’t violate them again.”

Facebook uses the strike system to impose a tiered set of punishments for various types of violations, with warnings escalating to temporary restrictions on posting content as a user piles up more strikes.

Sellers still disguise sales by listing “gun cases”

A Bloomberg article published after the recent Buffalo, New York, and Uvalde, Texas, mass shootings said that sellers often disguise gun sales by listing them as “gun cases.” Journalist Parmy Olson wrote:

This week I reached out to 10 sellers in Texas and Georgia whose listings hinted their title was a pretense: The price was an implausible $1, or they would put the word “case” in quotation marks, or implored buyers to “PM me for details” to find out “what’s inside.”

Five of the sellers replied with photos or details of semi-automatic rifles or pistols made by brands like Glock Ges m.b.H. and Sturm, Ruger & Co. One was a federally licensed gun dealer who had started selling on [Facebook] Marketplace last year. There were no similar listings that I saw on competing sites like eBay and Craigslist.

That ruse has continued for years despite Democratic senators calling on Facebook in September 2019 to crack down on the practice. “Unfortunately, it is not enough to simply announce a ban on firearm sales through Facebook. Effective monitoring and the suspension of accounts in violation of these policies is essential,” the senators told Facebook CEO Mark Zuckerberg at the time.

https://arstechnica.com/?p=1859959

Twitter now plans to comply with Elon Musk’s demand for user data that he says is needed to determine whether the company’s spam estimates are accurate, The Washington Post reported Wednesday.

“After a weeks-long impasse, Twitter’s board plans to comply with Elon Musk’s demands for internal data by offering access to its full ‘firehose,’ the massive stream of data comprising more than 500 million tweets posted each day, according to a person familiar with the company’s thinking, who spoke on the condition of anonymity to describe the state of negotiations,” the Post wrote.

Twitter declined comment on the Post report when contacted by Ars today but pointed to its statement from Monday that “Twitter has and will continue to cooperatively share information with Mr. Musk to consummate the transaction in accordance with the terms of the merger agreement.”

Whether Twitter has to give all the user data to Musk is under dispute. The Post report comes two days after Musk’s legal team sent a letter to Twitter claiming the company violated the merger agreement by refusing to provide the data behind its spam estimates.

Providing data could help Twitter complete sale

Twitter giving Musk the requested data could be bad for him if his real goal is getting out of the $44 billion purchase deal. It would undercut Musk’s claim that Twitter violated the merger agreement, and Twitter seems confident that its estimate is accurate.

Twitter could provide the data to Musk “as soon as this week,” the Post wrote. “Currently some two dozen companies pay for access to the trove, which comprises not only a real-time record of tweets but the devices they tweet from, as well as information about the accounts that tweet.”

Musk’s offer to buy Twitter waived “business due diligence,” but he says Twitter must provide the requested data because of a clause in the merger agreement that says he is entitled to information “for any reasonable business purpose related to the consummation of the transaction.”

Musk’s letter claims he has a “right to terminate the merger agreement” if Twitter doesn’t comply. The letter also said Musk needs a “complete and accurate understanding of the very core of Twitter’s business model—its active user base” in order to obtain financing and prepare for the ownership transition.

“Mr. Musk believes Twitter is transparently refusing to comply with its obligations under the merger agreement, which is causing further suspicion that the company is withholding the requested data due to concern for what Mr. Musk’s own analysis of that data will uncover,” the letter from Musk’s legal team said.

https://arstechnica.com/?p=1859810

Federal law enforcement agencies say they shut down a group of websites that made over $19 million selling Social Security numbers and other personal data.

A Justice Department press release yesterday announced “the seizure of the SSNDOB Marketplace, a series of websites that operated for years and were used to sell personal information, including the names, dates of birth, and Social Security numbers belonging to individuals in the United States.” SSNDOB apparently operated for about a decade, and the Justice Department said it listed the personal information of about 24 million US residents.

The announcement described how the SSNDOB operation was run:

The SSNDOB administrators created advertisements on darkweb criminal forums for the marketplace’s services, provided customer support functions, and regularly monitored the activities of the sites, including monitoring when purchasers deposited money into their accounts. The administrators also employed various techniques to protect their anonymity and to thwart detection of their activities, including using online monikers that were distinct from their true identities, strategically maintaining servers in various countries, and requiring buyers to use digital payment methods, such as bitcoin.

Seizure orders

The seizure operation was led by the IRS and FBI, with the agencies working in “close cooperation with law enforcement authorities in Cyprus and Latvia.” On Tuesday, “seizure orders were executed against the domain names of the SSNDOB Marketplace (ssndob.ws, ssndob.vip, ssndob.club, and blackjob.biz), effectively ceasing the website’s operation,” the announcement said.

No arrests were announced, but the press release said the US plans to conduct asset forfeiture as the investigation continues. The IRS said agents “will continue to work with the US and international law enforcement community to end these complex scams, regardless of where the money trail leads them.”

The seized domains seem to be part of the same operation as one detailed by security journalist Brian Krebs about nine years ago. In September 2013, Krebs wrote that SSNDOB “has for the past two years marketed itself on underground cybercrime forums as a reliable and affordable service that customers can use to look up SSNs, birthdays and other personal data on any US resident.” Krebs was swatted shortly after one of his articles on SSNDOB, which used the ssndob.ru domain at the time.

SSNDOB operators got their data in part by infiltrating LexisNexis, Dun & Bradstreet, and Kroll Background America. Hackers used data from SSNDOB to gain control of Xbox Live accounts held by some Microsoft employees, according to another Krebs report in 2013.

As security company Sophos noted in a story on yesterday’s shutdown, “an SSN doesn’t actively identify you,” but “knowing someone’s SSN (or the equivalent personal identifier in your country) is a good starting point if you’re an identity thief, because it can often be combined with other personal information to get past identity checks.”

SSNDOB was big on bitcoin

Security company Chainanlysis, which markets “investigation software that connects cryptocurrency transactions to real-world entities,” wrote that “SSNDOB’s Bitcoin payment processing system has been active since April 2015” and “has received nearly $22 million worth of Bitcoin across over 100,000 transactions.”

“Perhaps most interesting of all though is the activity we see between SSNDOB and Joker’s Stash, a large darknet market focused on stolen credit card information and other PII that shut down in January 2021,” Chainanlysis wrote. “Between December 2018 and June 2019, SSNDOB sent over $100,000 worth of Bitcoin to Joker’s Stash, suggesting the two markets may have had some relationship to one another, including possibly shared ownership.”

Chainanlysis also wrote that the SSNDOB shutdown is “the latest in a string of darknet market closures over the past year. … Over and over, illicit services that embrace cryptocurrency have opened themselves up to law enforcement scrutiny and been shut down, in large part because of the inherent transparency of blockchains.”

https://arstechnica.com/?p=1859669

The US Treasury Department has started approving broadband grants to states from a $10 billion fund created to expand access to Internet service and other digital connectivity tools.

The Treasury Department’s announcement on Tuesday said the first approved projects would “connect over 200,000 homes and businesses to affordable, reliable, high-speed Internet” in Louisiana, New Hampshire, Virginia, and West Virginia. The funded networks will provide symmetrical service with download and upload speeds of at least 100Mbps, the department said.

The four states are getting a combined $583 million from the $10 billion Coronavirus Capital Projects Fund (CPF), which Congress passed in March 2021 as part of the American Rescue Plan Act. “Treasury designed its guidance to prioritize connecting families and businesses with poor and inadequate service—particularly those in rural and remote areas. Treasury also requires states to explain why communities they have identified to be served with funds from the CPF have a critical need for those projects,” the department said.

The fund isn’t just for broadband as the legislation says the $10 billion shall be used “for making payments to States, territories, and Tribal governments to carry out critical capital projects directly enabling work, education, and health monitoring, including remote options, in response to the [COVID-19] public health emergency.” In addition to broadband, grant recipients can “make investments in other capital projects designed to directly enable work, education, and health monitoring and that meet Treasury’s other criteria,” the department says.

More cash on the way

The Treasury Department has also approved more than 30 capital projects for tribal areas, with many of them slated to expand broadband networks, buy computers and equipment, or provide Internet access to the public at community facilities. Treasury said it would keep approving state and tribal projects on a rolling basis.

The Capital Projects Fund is separate from the $42.45 billion Broadband Equity, Access, and Deployment program approved in November 2021, which will give subsidies to ISPs that build in unserved and underserved areas. That larger fund hasn’t given out any money yet, but the National Telecommunications and Information Administration (NTIA) announced rules for the program on May 13.

While the Biden administration is getting broadband funding out to states, plans to reinstate broadband regulations repealed during the Trump era have been on hold because Biden hasn’t gotten his Federal Communications Commission nominee, Gigi Sohn, past the finish line in the Senate. As Axios reported last week, “Democrats don’t currently have the votes after nearly eight months of drama around her nomination.”

Affordable Internet option required

The plans submitted by Louisiana, New Hampshire, Virginia, and West Virginia require ISPs that get deployment money to participate in the Affordable Connectivity Program run by the FCC. “The ACP helps ensure that households can afford the broadband they need for work, school, healthcare, and more by providing a discount of up to $30 per month,” the Treasury Department said. Biden recently announced voluntary commitments from large ISPs to offer $30-per-month plans to eligible households, effectively making the service free when combined with the discount.

“These four states have wisely chosen to prioritize local, affordable, and future-proof networks,” said Joshua Stager, deputy director of broadband and competition policy at New America’s Open Technology Institute.

Every state will get money from the fund eventually. The March 2021 law said the Treasury Department must give at least $100 million to each state, with remaining payments distributed to states based on overall population, rural population, and household income levels. States must submit their plans by September 24, 2022. The Capital Projects Fund is on “a notably faster timeline than other broadband infrastructure funds, such as the new NTIA program—so officials need to act soon,” Stager said.

The Capital Projects Fund has $100 million earmarked for tribal governments. There’s also $100 million to be split among the US Virgin Islands, Guam, American Samoa, the Northern Mariana Islands, the Marshall Islands, the Federated States of Micronesia, and Palau.

https://arstechnica.com/?p=1859516

Texas Attorney General Ken Paxton on Monday stepped into the Elon Musk/Twitter battle by launching an investigation into whether Twitter is hiding the extent of its spam-account problem. Paxton announced the investigation in a press release that echoes Musk’s claims and sent Twitter a letter demanding the same types of data on fake accounts that Musk hasn’t been able to get.

“Twitter has received intense scrutiny in recent weeks over claiming in its financial regulatory filings that fewer than 5 percent of all users are bots, when they may in fact comprise as much as 20 percent or more,” Paxton’s announcement said. Paxton’s press release says that an inaccurate estimate of bot accounts may “inflate the value of the company and the costs of doing business with it, thus directly harming Texas consumers and businesses.”

Though Paxton’s press release didn’t mention Musk, the “intense scrutiny” has been driven by Musk claiming that Twitter’s spam-account estimate is wrong. Additionally, Paxton’s concern that incorrect spam data would “inflate the value” of Twitter comes amid Musk’s attempts to get out of or renegotiate his $44 billion deal to buy Twitter—Musk agreed to pay $54.20 per share, and Twitter’s stock price was $39.59 at market close on Monday.

Paxton launched his investigation hours after Musk threatened to pull out of his Twitter purchase deal in a letter that claimed the company violated the merger agreement by refusing to provide the data behind its spam estimates. Paxton’s announcement also came a week after the US Supreme Court blocked a Texas law that prohibits social media companies from moderating content based on a user’s “viewpoint.”

Paxton and Musk mischaracterize Twitter spam estimate

Paxton’s press release echoes Musk by inaccurately describing Twitter’s spam-account estimate. Twitter does not claim that “fewer than 5 percent of all users are bots.” What Twitter says is that fewer than 5 percent of monetizable daily active users (mDAUs) are spam or fake, and the company defines mDAUs as “accounts who logged in or were otherwise authenticated and accessed Twitter on any given day through twitter.com, Twitter applications that are able to show ads, or paid Twitter products, including subscriptions.”

While Paxton’s announcement conflates “all users” with Twitter’s mDAU statistic, the Civil Investigative Demand his office sent is more precise. It asks for 23 types of documents, including ones showing “Twitter’s ‘average monetizable daily active users’ for each month from 2017 to the present” and documents on the number of inauthentic Twitter accounts.

Paxton’s demand letter seems to presume that Twitter’s mDAU statistic is false. The 13th of its 23 demands seeks “documents that contradict Your public statements that fewer than 5% of ‘false or spam accounts’ are included in Your ‘monetizable daily active users’ metric.” (“Your” is capitalized in the letter and used interchangeably with “Twitter.”)

Paxton alleges that Twitter’s spam estimate may be “false, misleading, or deceptive” under the Texas Deceptive Trade Practices Act. His demand letter said the state law (specifically, section 17.61) gives his office authority to demand the documents and said that Twitter has until June 27 to comply.

“Texans rely on Twitter’s public statements that nearly all its users are real people,” Paxton said. “It matters not only for regular Twitter users, but also Texas businesses and advertisers who use Twitter for their livelihoods. If Twitter is misrepresenting how many accounts are fake to drive up their revenue, I have a duty to protect Texans.”

Twitter declines comment on Texas investigation

Twitter declined to comment on the Texas investigation when contacted by Ars today. But the company yesterday pushed back against Musk’s claims that Twitter violated the merger deal and says it will enforce the agreement at the original price.

“Twitter has and will continue to cooperatively share information with Mr. Musk to consummate the transaction in accordance with the terms of the merger agreement,” the company’s statement Monday said. “We believe this agreement is in the best interest of all shareholders. We intend to close the transaction and enforce the merger agreement at the agreed price and terms.”

Musk’s offer to buy Twitter waived “business due diligence,” but he claims he is entitled to more spam data because “this information is necessary to facilitate the closing of the transaction.” Musk said he needs the data to obtain financing and prepare for the ownership transition and claimed he has a “right to terminate the merger agreement.”

While the sale agreement lets either Twitter or Musk kill the deal and pay a breakup fee of $1 billion under certain circumstances, Musk won’t necessarily be able to get out of it for only $1 billion. A specific performance provision in the merger deal says that if Twitter meets its obligations, it “shall be entitled to specific performance or other equitable remedy” to “cause the Equity Investor [Musk] to fund the Equity Financing, or to enforce the Equity Investor’s obligation to fund the Equity Financing directly, and to consummate the Closing.”

https://arstechnica.com/?p=1859437

On Monday, the Biden administration announced a suite of policy changes intended to boost the use of solar power within the US. While each individual policy change is relatively minor, combined, the changes address everything from manufacturing and importing to installation and integration with the power grid. While the administration is continuing to try to negotiate a deal that expands renewable energy via legislation, none of the initiatives announced today requires anything beyond executive action.

Who makes the panels?

At present, China dominates the manufacturing of solar cells and panels. But the Trump administration included solar hardware in its tariff war with the country. The Biden administration chose to eliminate the tariffs on the solar cells most often used in utility-scale installations but maintained them on other classes of cells. Complicating matters further, the US Commerce Department recently started an investigation into whether other countries in Asia were being used as conduits to ship panels around the tariffs.

Combined, these issues raised worries that tariffs would limit the growth of solar in the US, which is a problem given that it’s the cheapest way to generate power in many areas of the country and is central to the government’s plans to limit carbon emissions.

Monday’s announcement was accompanied by the decision to give these Asian countries a two-year suspension of tariffs on solar panels. But that decision was only mentioned briefly; instead, the focus of the formal announcement was largely on domestic production and use.

The announcement started by highlighting a bit of good news: At present, the US’s domestic solar manufacturing is on track to triple in capacity over the next two years and reach over 22 gigawatts by the end of Biden’s first term in office. This is impressive growth but also woefully insufficient, given that the US Energy Information Agency expects that solar installs will need all of those gigawatts in 2022 for utility-scale systems—and that’s not counting rooftop and commercial installs. (For comparison, the Chinese manufacturing capacity appears to be in the neighborhood of 25 times larger.)

The programs announced Monday include efforts to boost domestic manufacturing beyond its expected growth and to expand the integration of solar power into the grid.

Getting defensive

One of the tools Biden is using is the Defense Production Act. Originally designed to enable the country to produce military equipment, the act has most recently been in the news when it was used to enhance the national defenses against the COVID pandemic. Here, Biden is invoking it as a defense against energy shortages by directing the Department of Energy to expand the domestic production of photovoltaic modules and other necessary components of solar panels.

Accompanying that, he’ll work on establishing preferred supplier preferences for panels produced in the US, which will streamline the ability of the federal government to buy them. This is expected to create an annual demand for about a gigawatt of capacity.

More critically, the administration will work to get state and local governments to approve similar measures. This may sound like a minor gesture, but there are more than 400 municipal electric utilities (meaning they are owned and operated by a local government) in the US. As a result, the administration estimates that this could add as much as 10 gigawatts of demand for domestic solar.

Beyond the panels themselves, the Defense Production Act will be used for a lot of technologies that are renewable-adjacent. These include critical power-grid infrastructure to expand the distribution of renewable power, as well as ways of putting any excesses of power to use to create fuel. These include electrolyzers to split water and produce hydrogen and the fuel cells that can extract energy back from that hydrogen. Also included: efficient technology such as building insulation and heat pumps.

The need for domestic sources of solar panels is somewhat debatable, although Europe’s current experience with Russian energy supplies indicates it can be valuable for foreign policy reasons. But the remainder of the initiatives outlined here should provide a solid stimulus for the production of solar power, along with the ability to use it efficiently even in cases where it produces in excess of present demand. A key factor that will likely determine overall success will be the degree to which local governments get on board with the program.

https://arstechnica.com/?p=1859206

Lindsay Krall decided to study nuclear waste out of a love for the arcane. Figuring how to bury radioactive atoms isn’t exactly simple—it takes a blend of particle physics, careful geology and engineering, and a high tolerance for reams of regulations. But the trickiest ingredient of all is time. Nuclear waste from today’s reactors will take thousands of years to become something safer to handle. So any solution can’t require too much stewardship. It’s gotta just work, and keep working for generations. By then, the utility that split those atoms won’t exist, nor will the company that designed the reactor. Who knows? Maybe the United States won’t exist either.

Right now, the US doesn’t have such a plan. That’s been the case since 2011, when regulators facing stiff local opposition pulled the plug on a decades-long effort to store waste underneath Yucca Mountain in Nevada, stranding $44 billion in federal funds meant for the job. Since then, the nuclear industry has done a good job of storing its waste on a temporary basis, which is part of the reason Congress has shown little interest in working out a solution for future generations. Long-term thinking isn’t their strong suit. “It’s been a complete institutional failure in the US,” Krall says.

But there’s a new type of nuclear on the block: the small modular reactor (SMR). For a long time, the US nuclear industry has been stagnating, in large part because of the tremendous costs of building massive new plants. SMRs, by contrast, are small enough to be built in a factory and then hauled elsewhere to produce power. Advocates hope this will make them more cost-effective than the big reactors of today, offering an affordable, always-on complement to less-predictable renewables like wind and solar. According to some, they should also produce less radioactive waste than their predecessors. A Department of Energy-sponsored report estimated in 2014 that the US nuclear industry would produce 94 percent less fuel waste if big, old reactors were replaced with new smaller ones.

Krall was skeptical about that last part. “SMRs are generally being marketed as a solution—that maybe you don’t need a geological repository for them,” she says. So as a postdoc at Stanford, she and two prominent nuclear experts started digging through the patents, research papers, and license applications of two dozen proposed reactor designs, none of which have been built so far. Thousands of pages of redacted documents, a few public records requests, and a vast appendix full of calculations later, Krall, who is now a scientist with Sweden’s nuclear waste company, got an answer: By many measures, the SMR designs produce not less, but potentially much more waste: more than five times the spent fuel per unit of power, and as much as 35 times for other forms of waste. The research was published in the Proceedings of the National Academy of Sciences earlier this week.

Startups seeking licenses to build SMR designs have disputed the findings and say they’re prepared for whatever waste is generated while the US sorts out permanent disposal. “Five times a small number is still a really small number,” says John Kotek, who leads policy and public affairs at the Nuclear Energy Institute, the industry’s trade association.

But the authors say the “back-end” of the fuel cycle, which includes waste and decommissioning, should be a bigger factor in what they consider to be the precarious economics of the new reactors. “The point of this paper is to prompt a discussion,” says Allison Macfarlane, a former chair of the US Nuclear Regulatory Commission and a coauthor of the paper. “We can’t get to how much it is going to cost until we understand what we’re dealing with.”

Designing smaller reactors may make them easier to build, but it also creates a problem: neutron leakage. Reactors produce energy by firing neutrons at uranium atoms, causing them to split. This sends out more neutrons, which in turn find other targets and cause a chain reaction. But some of these neutrons miss. Instead, they fly out of the core, hitting other parts of the reactor that become “activated,” or radioactive. Inside SMRs, there’s less space for the neutrons to jostle around in, so more of them leak. There’s no getting around the issue. “We’re basically dealing with gravity here, the laws of physics,” Krall says. “It’s something you have to engineer your way around.”

https://arstechnica.com/?p=1858107

New York’s state legislature approved a bill that would prevent fossil fuel power plants from being revived to power cryptocurrency mining operations. If signed by Gov. Kathy Hochul, the proposed law would prevent new permits from being issued for two years.

It’s a “first-in-the-nation cryptocurrency mining moratorium bill,” advocacy group Earthjustice said Friday. “While the bill would not cover fossil fuel burning crypto mining operations that have already applied for new or renewed air permits, it would ensure that any future facilities could not receive air permits for two years, while the State Department of Environmental Conservation conducts a thorough study on proof-of-work crypto mining,” the group said.

The bill’s prospects looked dim earlier this week but was passed by the state Senate in a 36-27 vote after 12 am on Friday morning. It was previously approved by the Assembly with a 95-52 vote in April.

“Despite the cryptocurrency industry spending millions lobbying against the bill and circulating misinformation, the legislation passed the Assembly with broad support,” the office of State Senator Kevin Parker (D-21) said last month in a press release that urged the Senate to take action. The bill’s goal is to pause “the dirty practice or refiring retired fossil fuel power plants for crypto mining,” the press release said.

By passing the new state law, “the legislature has rightly said fossil fuel power plants can’t get a second life in New York just for private industry gain, which would fly in the face of the state’s climate mandates,” said Earthjustice New York Policy Advocate Liz Moran.

Bill targets proof-of-work mining

The bill says that during the two-year moratorium, the state cannot approve any new air permit “for an electric generating facility that utilizes a carbon-based fuel and that provides, in whole or in part, behind-the-meter electric energy consumed or utilized by cryptocurrency mining operations that use proof-of-work authentication methods to validate blockchain transactions.”

The bill further says the state “shall not approve an application to renew an existing permit or issue a renewal permit… if the renewal application seeks to increase or will allow or result in an increase in the amount of electric energy consumed or utilized by” a proof-of-work cryptocurrency mining operation.

The bill also requires state agencies to prepare “a generic environmental impact statement on cryptocurrency mining operations that use proof-of-work authentication methods to validate blockchain transactions.” The review would examine the amount of electricity used by these operations, the types of fuel used, the impact on greenhouse gas emission reduction goals, other environmental impacts, and health impacts “due to reduced air and water quality in communities near cryptocurrency mining operations.”

Bitcoin uses the energy-intensive proof-of-work method. The Ethereum project intends to shift from proof-of-work to proof-of-stake as soon as August. As a post on the project’s website says, the proof-of-stake method “uses drastically less energy, and enables new scaling solutions to be implemented” but “is also more complex than proof-of-work and refining the mechanism has taken years of research and development. The challenge now is to implement PoS on the live Ethereum network—a process known as ‘The Merge.’“

https://arstechnica.com/?p=1858208

The fight for the right to repair scored a huge win Friday with New York state passing a bill that requires digital electronics manufacturers, like laptop and smartphone manufacturers, to make diagnostic and repair information available to consumers and independent repair shops.

The bill, which passed in the New York Senate (49 to 14) on Wednesday and in the Assembly (145 to 1) today, enacts the Digital Fair Repair Act. Governor Kathy Hochul has to sign the bill before it is law, but advocates, like iFixit, said they don’t expect obstacles there.

Notably, the bill doesn’t pertain to medical devices, home appliances, agricultural and off-road equipment, or public safety communications equipment. However, right-to-repair advocates have their eye on those areas as well. The bill also doesn’t cover motor vehicles.

Companies selling tech products in New York that are covered will be obligated to distribute information, software, tools, and parts so that individuals and independent repair shops can repair personal devices on their own. iFixit said it expects this to take effect by 2023.

More specifically, the bill says it:

“Requires OEMs to make available, for purposes of diagnosis, maintenance, or repair, to any independent repair provider, or to the owner of digital electronic equipment manufactured by or on behalf of, or sold by, the OEM, on fair and reasonable terms, documentation, parts, and tools, inclusive of any updates to information. Nothing in this section requires an OEM to make available a part if the part is no longer available to the OEM. For equipment that contains an electronic security lock or other security-related function, the OEM shall make available to the owner and to independent repair providers, on fair and reasonable terms, any special documentation, tools, and parts needed to access and reset the lock or function when disabled in the course of diagnosis, maintenance, or repair of the equipment. Such documentation, tools, and parts may be made available through appropriate secure release systems.”

Fighting “monopolistic practices”

The bill successfully argued that it will help protect against “monopolistic practices of digital electronics manufacturers,” brought on by the withholding of repair and diagnostic information. This forced consumers to rely on product manufacturers and their authorized repair providers. According to a blog post by iFixit CEO Kyle Wiens today, 59 percent of independent repair shops in California recently reported fear of closure without the right to repair.

“Nothing prevents third-party repairers from being technically competent to complete digital repairs other than the lack of information being withheld by manufacturers,” the bill states. “In too many instances, repairs of digital items are intentionally limited by the manufacturer.”

The bill also points to “inflated, high repair prices, poor service or non-existent service in rural areas, and unnecessarily high turnover rates for electronic products” as justification for the legislation.

E-waste was also a driver for the bill, as well as the general fight for the right to repair. In a statement, New York Assemblymember Patricia Fahy said the bill would “help to reduce the 655,000 tons of toxic e-waste produced [and] typically discarded in a single calendar year here in New York state.”

In its announcement, the New York State Assembly pointed to a study by the US Public Interest Group finding that the average New York family would save approximately $330 per year and reduce electronic waste by 22 percent with the right to repair.

Beyond the Empire State

While right-to-repair advocates scored a notable win, there’s much more legislation required before the right extends across the country and product categories.

In his blog Friday, iFixit’s Wiens pointed to the impact the passing of the law is expected to have around the world. For one, the exec hopes that manufacturers will make repair manuals open to everyone, not just New Yorkers.

Wiens also expressed hope for software protections catching on outside of New York.

“The New York law includes provisions for resetting the software locks that some manufacturers use to tie parts to the device’s motherboard or serial number. Manufacturers will have to find some way to make parts pairing reset tools available to the public. That’s a huge boon for repair, but it also helps the refurbishment industry: Lots of refurbishers harvest parts from old devices, which is impossible when those devices have parts paired to the motherboard,” Wiens said, noting related infrastructure challenges facing vendors.

Ars recently spoke with Wiens, who discussed the biggest challenges and happenings in the fight for the right to repair, including the necessity of federal involvement. You can check out our interview on the right to repair with iFixit’s CEO here.

https://arstechnica.com/?p=1858174

Canadian investigators determined that users of the Tim Hortons coffee chain’s mobile app “had their movements tracked and recorded every few minutes of every day,” even when the app wasn’t open, in violation of the country’s privacy laws.

“The Tim Hortons app asked for permission to access the mobile device’s geolocation functions but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data,” according to an announcement Wednesday by Canada’s Office of the Privacy Commissioner. The federal office collaborated with provincial authorities in Quebec, British Columbia, and Alberta in the investigation of Tim Hortons.

“The app also used location data to infer where users lived, where they worked, and whether they were traveling,” the Office of the Privacy Commissioner said. “It generated an ‘event’ every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace.”

Tim Hortons scrapped plans to use the app for targeted advertising but “continued to collect vast amounts of location data” for another year “even though it had no legitimate need to do so,” the Office of the Privacy Commissioner said. Tim Hortons said it used aggregated location data “to analyze user trends—for example, whether users switched to other coffee chains, and how users’ movements changed as the pandemic took hold,” the federal office said.

“Inappropriate form of surveillance”

Canada Privacy Commissioner Daniel Therrien said, “Tim Hortons clearly crossed the line by amassing a huge amount of highly sensitive information about its customers. Following people’s movements every few minutes of every day was clearly an inappropriate form of surveillance.”

Tim Hortons has more than 5,100 stores in 13 countries. Most are in Canada, but there are more than 600 in the US, mostly in New York, Michigan, and Ohio.

Tim Hortons halted the continual tracking of users’ locations in 2020 after the government began investigating. But that “did not eliminate the risk of surveillance” because “Tim Hortons’ contract with an American third-party location services supplier contained language so vague and permissive that it would have allowed the company to sell ‘de-identified’ location data for its own purposes,” the Office of the Privacy Commissioner said. As the office noted, there “is a real risk that de-identified geolocation data could be re-identified.”

Tim Hortons agreed to implement the agencies’ recommendations but apparently will not face any punishment. The investigative report said that Tim Hortons’ commitments “will bring the company into compliance” with Canadian law and that “we therefore find this matter to be well-founded and conditionally resolved.” That’s the language used when an organization violates Canadian privacy laws but has “committed to implementing satisfactory corrective actions.”

The announcement said Tim Hortons agreed to “delete any remaining location data and direct third-party service providers to do the same,” implement a privacy program that “includes privacy impact assessments for the app and any other apps it launches,” implement “a process to ensure information collection is necessary and proportional to the privacy impacts identified,” and ensure “that privacy communications are consistent with, and adequately explain, app-related practices.” Tim Hortons also agreed to report back to the government with details on its compliance.

Reporter uncovered privacy violation

The investigation began after a June 2020 Financial Post report titled “Double-double tracking: How Tim Hortons knows where you sleep, work, and vacation.” Reporter James McLeod found that “Tim Hortons had recorded my longitude and latitude coordinates more than 2,700 times in less than five months, and not just when I was using the app,” even though the app “told customers that it tracks location ‘only when you have the app open.'”

Tim Hortons’ statement said, “In June 2020, we took immediate steps to improve how we communicate with guests about the data they share with us and began reviewing our privacy practices with external experts. Shortly thereafter, we proactively removed the geolocation technology outlined in the report from the Tims app. Data from this geolocation technology was never used for personalized marketing for individual guests. The very limited use of this data was on an aggregated, de-identified basis to study trends in our business—and the results did not contain personal information from any guests.”

Alberta Information and Privacy Commissioner Jill Clayton said the investigation provides “yet another example where an organization has not effectively notified customers about its practices. Tim Hortons’ customers did not have adequate information to consent to the location tracking that was actually occurring.”

https://arstechnica.com/?p=1857804